cow-swap[.]co

This domain, cow-swap.co, is flagged as a high-risk brand impersonation site targeting Ethereum cryptocurrency users. Analysis indicates the domain mimics the legitimate Cow Swap decentralized exchange platform, presenting itself as a "Secure and Efficient Crypto Trading Platform" to deceive victims. The threat type is classified as brand_impersonation, with no direct evidence of a drainer kit at this time, though the infrastructure aligns with common cryptocurrency phishing tactics.

Technical indicators confirm the malicious nature of the domain. cow-swap.co was registered on February 21, 2026, and is hosted on IP address 172.67.176.189, associated with AS13335 (Cloudflare, Inc.). VirusTotal reports 20 out of 95 security vendors flagging the domain as malicious. The SSL certificate is classified as WE1, a low-trust indicator. The domain appears on three security blocklists and is actively blocked by multiple cryptocurrency wallet providers. Google Safe Browsing status is not explicitly provided, but the domain's infrastructure and detection metrics align with confirmed phishing sites.

As of the latest assessment, cow-swap.co has been taken offline, likely due to enforcement actions by hosting providers or security vendors. Despite its current inactive status, residual risk remains for users who may have interacted with the domain during its operational window. Organizations are advised to update blocklists, monitor for related IOCs (e.g., IP 172.67.176.189, domain registration date), and educate users on recognizing brand impersonation tactics in cryptocurrency platforms. Proactive measures, such as DNS filtering and endpoint protection rules, should be enforced to prevent exposure to similar threats.